Red Hat Red Hat OpenShift Virtualization 4
19 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-92982 | | Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection | HIGH 8.5 | 0.5 % | ||
| CVE-2026-102623 | | Kubevirt: kubevirt: virt-controller nil-pointer dereference via malformed ephemeral volume | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-79699 | | Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory | MEDIUM 4.4 | 0.2 % | ||
| CVE-2026-79705 | | Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers | MEDIUM 4.5 | 0.4 % | ||
| CVE-2026-19730 | | Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives | MEDIUM 4.2 | 0.1 % | ||
| CVE-2026-17527 | | Virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing… | HIGH 7.7 | 0.6 % | ||
| CVE-2026-13434 | | Virt-controller-rhel9: kubevirt: kubevirt: multus default-network annotation injection via unvalidated tenant networkname when externalne… | MEDIUM 4.9 | 0.2 % | ||
| CVE-2026-13322 | | Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service | LOW 3.8 | 0.1 % | ||
| CVE-2026-13318 | | Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip | MEDIUM 6.4 | 0.2 % | ||
| CVE-2026-13218 | | Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher | MEDIUM 4.2 | 0.1 % | ||
| CVE-2026-13208 | | Kubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts vmi identity from unauthenticated grpc request body | MEDIUM 6.5 | 0.1 % | ||
| CVE-2026-9804 | | Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read | HIGH 7.7 | 0.5 % | ||
| CVE-2026-6383 | | Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation | MEDIUM 5.4 | 0.1 % | ||
| CVE-2025-14525 | | Kubevirt: kubevirt: vm administration denial of service via guest agent | MEDIUM 6.4 | 0.3 % | ||
| CVE-2025-14946 | | Libnbd: libnbd: arbitrary code execution via ssh argument injection through a malicious uri | MEDIUM 4.8 | 0.1 % | ||
| CVE-2024-4467 | | Qemu-kvm: 'qemu-img info' leads to host file read/write | HIGH 7.8 | 0.3 % | ||
| CVE-2024-31420 | | Cnv: dos through repeatedly calling vm-dump-metrics until virt handler crashes | MEDIUM 6.5 | 0.6 % | ||
| CVE-2024-31419 | | Cnv: information disclosure through the usage of vm-dump-metrics | MEDIUM 4.3 | 0.4 % | ||
| CVE-2023-3089 | | Ocp & fips mode | HIGH 7.5 | 0.5 % |